A production misconfiguration in six Microsoft 365 Android applications—Word, PowerPoint, Excel, Microsoft 365 Copilot, Microsoft Loop, and OneNote—exposed billions of installations to unauthorized Microsoft account (MSA) token theft. The vulnerability stemmed from a debug flag, IsDebugMode(true), erroneously shipped in production binaries. This setting disabled critical isolation mechanisms designed to restrict OAuth 2.0 tokens to authorized Microsoft applications, allowing malicious third-party apps on the same device to intercept sensitive tokens via Android Inter-Process Communication (IPC) and Intents. Successful exploitation enables full Account Takeover (ATO), bypassing authentication boundaries to grant unauthorized access to sensitive cloud data, including Outlook emails and OneDrive documents.

• Vulnerability Analysis: The Debug Leak

  • Root cause identified as a single line of code where the IsDebugMode flag was set to true in production.
  • This configuration altered the behavior of internal security checks, effectively bypassing the validation of requesting applications.
  • The flaw essentially disabled the "authorized app" whitelist, which typically ensures tokens are only shared between trusted Microsoft components.

• Technical Vector: Token Interception

  • Attack Vector: Exploitation of Android Inter-Process Communication (IPC) using specially crafted Intents.
  • Mechanism: The misconfiguration allowed external applications to trigger activities that should have been restricted to internal use.
  • Artifacts: Targeted the OAuth 2.0 token exchange process within shared authentication libraries used across the Microsoft 365 ecosystem.

• Impact Assessment: Scale and Reach

  • Exposure Scale: Potentially affecting billions of downloads across six major productivity applications.
  • Threat Model: Any malicious application installed on the same device could silently request and receive valid MSA tokens.
  • Data Risk: Direct path to ATO, providing persistent access to the user's entire Microsoft cloud identity and associated enterprise or personal data.

• Remediation: MSRC Response

  • Immediate Fix: The Microsoft Security Response Center (MSRC) confirmed the flaw and pushed updates to all six affected applications to disable debug mode.
  • Mitigation: Developers are advised to strictly audit the android:exported attribute in the Android Manifest to prevent unintended component exposure.
  • Preventative Measure: Implementation of automated CI/CD pipeline checks to strip development-specific flags and debug configurations from release binaries.

• Platform Context: Android Manifest Security

  • Highlights the systemic risk of "configuration drift" where development settings leak into live production environments.
  • Underscores the critical nature of the android:exported attribute; when set to true, components can be launched by any app on the device.
  • Demonstrates how a single error in a shared library or configuration file can propagate vulnerabilities across a massive product portfolio.